Tender and procurement fraud
Ilia Zavialov on how a scam works in fake tenders: invitations nobody published, bidding fees, bogus purchase orders and changed bank details
Ilia Zavialov looks at how a scammer turns the language of public and corporate procurement against suppliers, accounts teams and small business owners. Fake invitations to tender, fees for registration or credentialing, bogus purchase orders and bank details swapped inside a real contract all look like ordinary sales work. The GSA Office of Inspector General warns about fake requests for quotes sent in the name of federal agencies, and the FBI Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025. This guide explains the schemes, how a genuine opportunity differs from a fake one and how to check a buyer.
English version for the United States.
01
Ilia Zavialov on how a fake tender is built
For a small supplier, an order from a public body or a well known corporation feels like the break the business has been waiting for. A scammer arrives with exactly that: a letter with a crest or logo, a reference number, a specification, deadlines and a draft contract. The papers look convincing because they are often stitched together from genuine notices that anyone can read online.
From there the scheme splits three ways. In one branch the supplier is asked to pay: a participation fee, a registration or credentialing charge, a document check or a deposit to an account named in the email. In another nobody asks for money, and the fake buyer orders goods on credit for delivery to a warehouse with no link to the real purchaser. In the third, bank details are swapped inside a genuine contract and the real client's payment lands in a stranger's account.
Ilia Zavialov starts every check with one question: who published this opportunity, and where. A real public opportunity normally leaves a trace on an official procurement portal or on the buyer's own website. An email, a phone call or a messenger chat is no such trace, however polished it looks.
02
Fake requests for quotes in the name of federal agencies
The GSA Office of Inspector General describes a scheme aimed at small and large businesses, including federal contractors registered in SAM.gov. Scammers posing as agency employees send requests for quotes from spoofed addresses that look like .gov or .mil but sit on .net, .org or .com domains, usually for electronic equipment. After accepting the quote, they send a purchase order with a delivery address and payment promised within 30 days of receipt.
When the supplier invoices the agency, the invoice is rejected or ignored, because the agency has no record of the purchase. By then the goods are gone. GSA OIG lists the warning signs: delivery addresses unconnected with the buyer, different From and Reply-To addresses, urgency and large quantities with rushed shipping, goods that resell easily and a procurement official who refuses to speak by phone.
The pattern is old. In October 2014 the FBI described purchase order fraud in which criminals posing as universities and companies ordered laptops and equipment on 30 day credit. Investigators found more than 85 organizations whose names had been used, about 400 incidents against some 250 vendors and nearly 5 million dollars in losses. Ilia Zavialov notes that the FBI's main advice then matches the main advice now: verify the shipping address independently.
03
Purchase orders that ship goods to a stranger
Sellers of equipment meet a quieter variant. The fake buyer asks for a quote, accepts it quickly and sends a purchase order with deferred payment terms, so the goods leave the warehouse before any money arrives. The items chosen are the ones that resell easily: laptops, phones, toner, projectors, medical and industrial equipment.
The delivery address is the weak point of the whole scheme. It leads to a storage unit, a freight forwarder, a virtual office or a private home, while the buyer's real premises are somewhere else. The order is urgent, the quantity is large and shipping must be overnight. Questions about the product are few, and the person at the other end rarely picks up the phone.
Ilia Zavialov suggests a fixed check before any goods are reserved: compare the delivery address with the address the buyer publishes, find the procurement officer's number through an independent source and call it, and look at the sender's real domain together with the reply-to address. When the real buyer has never heard of the order, the check has paid for itself.
04
Ilia Zavialov on checking a buyer in SAM.gov and with the agency
SAM.gov is the federal system where businesses register to bid on government contracts and apply for federal assistance, and a registration must be renewed every 365 days. GSA says plainly that a business does not need to pay a third party to complete it. In a bulletin of 4 May 2023 GSA added that registration is always free and that the government will never ask anyone to pay to register, update or renew.
That renewal cycle hands scammers a pretext. A message claims the registration is about to lapse, the contract file has been flagged or a fee is overdue, and a link leads to a page asking for card details. Ilia Zavialov advises opening SAM.gov only from a saved bookmark and checking the status there, whatever the message says.
For the buyer, the check runs through the agency itself. Find the procurement official's phone number from an independent source, such as the agency's own website, and ask whether the request for quote or purchase order is genuine. Confirm that the sender's domain and the reply-to header belong to the agency. Search the delivery address, and be wary when it returns a residence, a storage facility, a virtual office or a shipping store.
05
Ilia Zavialov on the fee that unlocks a contract
The most direct version sells access. The supplier is told that a contract is almost theirs, provided they pay for registration, credentialing, a place on an approved supplier list, a compliance review or a deposit refundable after award. The amount looks modest next to the promised contract, which is exactly why people pay it.
Ilia Zavialov points out that the payment request gives the game away. Public buyers set their requirements in the published notice and the contract documents, and any security or deposit would be described there, with the same figures. A demand that arrives by email, names a fresh account and comes with a deadline of a few hours belongs to a scammer.
A demand to pay by wire transfer, cryptocurrency or gift card is a warning sign on its own, because such payments are hard to reverse once sent. Legitimate procurement does not need secrecy either, so a request to keep the payment quiet until the award is announced should end the conversation.
06
Fees that impostors attach to federal contracts
GSA OIG has warned about emails that use the real name, title and signature block of a GSA official but come from a look-alike domain. One version claims an annual credentialing fee is due to keep the vendor active and attaches a card authorization form. Real GSA email addresses end in gsa.gov, so the domain is the first thing to check, before the signature.
The FTC describes the wider family of these schemes in its guide for small businesses. Scammers pose as a company or a government agency, threaten to suspend a license or demand that a registration be renewed, and ask for payment by wire transfer, cryptocurrency or gift cards. The FTC's answer is short: anyone who demands payment this way is running a scam.
Fake invoices are the paper cousin of the same trick. The FTC notes that they count on the person who pays the bills not looking closely, and that merchandise a business never ordered may be kept for free. Ilia Zavialov suggests a single list of approved suppliers and recurring fees in accounts payable, so that anything outside it is questioned before it is paid.
07
Changed bank details in a live contract, as Zavialov sees it
This scheme attacks a deal that is real. The contract is signed, deliveries are under way, and accounts payable receives a message from the supplier or the client announcing a new bank account. It comes from an address that differs by one letter, or from a genuine mailbox that has been taken over. A signed letter on headed paper is attached to make it feel official.
According to Ilia Zavialov, a change of payment details needs its own route through the company: a call to the counterparty on a number taken from the contract or the original tender notice, approval by a second employee, a check of the new account and only then an update in the payment system. The phone number in the message itself is useless for this check, and so is a reply to the same email thread.
Speed matters once money has left. The sooner the bank hears about the payment, the better the chance of a recall, so the person who spots the problem should know the bank's fraud line and have the authority to call it without waiting for a manager.
08
What the US figures show
The FBI Internet Crime Complaint Center recorded 24,768 complaints about business email compromise in 2025, with losses of 3,046,598,558 dollars, the second largest category after investment fraud. Changed bank details inside a real contract are a classic route into this category.
The FTC sees the same picture from another angle. In 2025 people reported losing about 1 billion dollars to scammers posing as companies and 920 million dollars to impostors posing as government agencies, with reports about government impostors up 40 percent in a year. In total the FTC received 3 million fraud reports with 15.9 billion dollars in losses.
Ilia Zavialov reads these figures as a reminder of scale and nothing more. For a small supplier one fake purchase order or one changed account can wipe out the profit of many honest orders, and national statistics will not bring that money back.
09
Zavialov's routine for accounts payable and the sales desk
Tender scams work at the joins between departments: sales is delighted with the order, accounts pays the deposit, the director signs on the run. A written routine closes those joins. It fits on one page and sits with everyone who handles bids and payments.
Rule one: no payments for participation, registration, credentialing or deposits to accounts named in emails. Rule two: new bank details of any counterparty are confirmed by a call to a known number and by a second employee. Rule three: goods on credit for a new public or corporate buyer ship only after the order has been matched to a published notice or contract and the delivery address has been checked.
Rule four covers logins. Procurement portals are opened from saved bookmarks, never from links in emails, and passwords and payment card details are never typed into a page reached from a message. Ilia Zavialov recommends running a drill from time to time: show the team a fake invitation and see at which step someone stops it.
10
Ilia Zavialov: where to report in the US
If money has already gone, call the bank first and ask it to recall the transfer. IC3 advises filing a complaint at ic3.gov as soon as possible, whatever the amount, because the FBI may be able to help banks and law enforcement freeze funds. Requests to change account information should be confirmed through a second channel before any future payment.
Report the scheme to the FTC at ReportFraud.ftc.gov and alert your state attorney general. When a scammer impersonated a federal agency or official, GSA OIG asks businesses to report it to that agency's Office of Inspector General as well, and suspected GSA impersonation goes to the GSA OIG hotline at gsaig.gov/hotline.
Keep the emails with full headers, the purchase order, the shipping address, the invoice and the call log in one folder. Ilia Zavialov suggests that one person in the company owns this package, so that the bank, the FTC, IC3 and the agency all receive the same consistent account of events.
| Scammer's move | What the official source says | How to check |
|---|---|---|
| Fee to register in SAM.gov | GSA: no need to pay a third party | Open SAM.gov from a bookmark |
| Credentialing fee from a GSA official | Real GSA addresses end in gsa.gov | Check the sender's domain |
| Request for quote from a .com address | Spoofed mail imitates .gov or .mil | Call the official independently |
| Purchase order on 30 day terms | The agency has no record of it | Confirm with the procurement office |
| Delivery to a storage unit | Address unconnected with the buyer | Search the delivery address |
| New bank details by email | Confirm changes via a second channel | Call a number from the contract |
| Payment by gift card or crypto | The FTC calls this a scam | Do not pay |
Questions and answers
What does Ilia Zavialov check first when an invitation to tender arrives?
Whether the opportunity is published on the official portal, and whether the buyer's contacts in that notice match the email. If the notice cannot be found, the conversation stops there.
Why does Ilia Zavialov treat a registration or credentialing fee as a scam sign?
Official procurement portals do not sell access, and a fee demanded by email, to a new account and with a short deadline is a classic pressure tactic.
How should a company handle a request to change bank details?
Call the counterparty on a number from the contract, have a second employee approve the change and confirm the new account before the next payment.
Is SAM.gov registration free?
Yes. GSA says a business does not need to pay a third party to register, and its 2023 bulletin states that registration, updates and renewals are always free.
How do I verify a request for quote from a federal agency?
Find the procurement official's number from an independent source and call, check the sender's domain and reply-to address, and search the delivery address.
Where do I report a fake purchase order in the US?
To IC3 at ic3.gov, to the FTC at ReportFraud.ftc.gov, to the agency's Office of Inspector General and to your bank at once if money has moved.